adaptive firewall help

[r1chardgreen]

I run a web server which, occasionally, appears to be subject a simple attack from a single IP address at one time (varies geographically, could be a zombie, or perhaps a legitimate customer of ours who travels and has a broken system).

The errant client opens hundreds of connections per second (netstat shows these are established connections, which is why I wonder if it's just a broken system - it it was a DOS why bother to complete the connection).

Once all the 256 connections my Apache configuration allows, no other clients can connect to my web site.

To handle this sort of problem automatically rather than responding manually with the addition of an IP table rule I'd like to limit the rate at which client connections are accepted from a single IP address (allow a burst to a count of 50 connection within a couple of seconds, then back off and deny the IP address access for increasing periods of time). I think this should allow sufficient access for legitimate clients behind NAT devices.

This sounds like a job for a firewall but I don't really know where to start with creating an adaptive firewall that can do this.

What tools are available (and recommended) for detecting and managing this sort of problem without manual intervention?

Cheers

Richard

[nightblade]

There is a plugin for Snort, that is specifically targeted in blocking IP addresses in response to attacks and other suspicious activity.

I have never experimented it, but you might want to give it a try

http://www.snortsam.net/

Please let me know if it works !
_________________
In God we trust. All the others must provide a valid X.509 certificate

[lwithers]

You can use a rate-limiting rule in iptables to do this. Once you have emerged iptables, do "man iptables" and search for "dstlimit" and "limit", which are the two rules you will use to do this. Note that you'll need to have compiled the relevant modules into your kernel in the netfilter configuration section.

[r1chardgreen]

lwithers:

[nightblade]

[hanj]

I would say that snortsam is the ticket. I would first install snort, and see if it sees the activity.. if it can, you can control it via snortsam. Do you know if the DoS is just a connection.. or are they looking for a specific file, or are they trying to attack an existing exploit (ie cmd.exe, etc), etc?

To get snort, you'll need snort-2.2.0. There is a USE flag for snortsam in that version in portage.

[r1chardgreen]

[Minox]